AIKIDO-2026-328865

TL;DR

While compiling a stylesheet, exsltFuncResultComp follows parent pointers to check that func:result is under func:function. If that ancestor is missing, the check continues onto the document node and reads the ns slot, which on a document node holds the compression and standalone integers, so a stylesheet with a misplaced func:result can crash the process. The fix stops the parent check at the document node.